Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
How to Read a Regular Expression: Literals, Metacharacters, Character Classes, Anchors and Escaping
The engine tries the pattern from left to right at every start position in the input and returns the leftmost match, which is why escaping metacharacters, writing class ranges correctly and knowing the anchors matter. We show with real output that in .NET \d accepts Arabic-Indic digits and $ accepts a trailing \n, and validate ISBN-13 and order numbers with .NET, JavaScript and grep.
Quantifiers and Backtracking: Greedy, Lazy, Possessive and Atomic Groups
A greedy quantifier first takes all it can and gives characters back one by one when the rest of the pattern fails; a lazy one takes little and adds one at a time, yet both spend steps searching for the delimiter, and the correct and fastest option is usually a negated class. We compare greedy, lazy, possessive and atomic groups with PCRE2 step counts and extract endpoint, status and duration from Bookstore's access log with .NET, JavaScript and sed.
Groups and Backreferences: Capturing, Named Groups, Non-capturing Groups, Alternation and $1/${name} in Replacements
Capturing groups are numbered by the order of their opening parentheses, but .NET puts named groups last, so the same $2/$1 replacement gives different results in .NET and JavaScript. We compare named group syntaxes, ES2025 duplicate group names, finding repeated words with backreferences, POSIX's longest-match rule and the replacement syntax of .NET, JavaScript, sed and VS Code with real output, and fix author names in Bookstore's CSV.
Lookaround, Inline Flags and Unicode: Lookahead, Lookbehind, (?i), \p{L} and Turkish Characters
Lookahead and lookbehind check what comes after or before a position without consuming characters; variable-length lookbehind works in .NET and JavaScript, is bounded in PCRE2 and absent in ripgrep. We show inline flags, JavaScript's (?i:…) modifiers, \p{L} and the v flag, and, with real output, that whether ıssız matches ISSIZ in .NET depends on the environment because IgnoreCase follows the culture.
Regex Flavors: How .NET, JavaScript, PCRE2, POSIX BRE/ERE and RE2 Differ, and Telling Globs from Regex
The same pattern works, fails or silently matches something else depending on the flavor: the Perl family (.NET, JavaScript, PCRE2) offers lookaround through backtracking, RE2 and Rust regex give it up for linear time, and POSIX picks the longest match. We run one probe list in five engines, show Prometheus's full-match =~ with promtool, and the difference between globs and regex with .gitignore and PowerShell.
Regex on the Command Line and in the IDE: grep -E/-P, ripgrep, sed, git grep, PowerShell and Repo-Wide Find/Replace
The safe order for a repo-wide regex change is: a clean working tree, the file list from git grep, a preview with rg -r, applying with sed -E and checking with git diff. We show the regex differences of grep, ripgrep, PowerShell and the IDEs, a real refactor in Bookstore that turns interpolated log calls into message templates, and why $ does not match in a CRLF file, together with .NET 11's AnyNewLine option.
Regex in .NET: GeneratedRegex, RegexOptions, Timeouts, NonBacktracking and Span APIs
Use [GeneratedRegex] for constant patterns, create run-time patterns once and keep them, and give untrusted input a timeout or NonBacktracking; in our measurement new Regex(..., Compiled) on every call was thirty-three thousand times slower than the source generator. A BenchmarkDotNet measurement, allocation-free EnumerateMatches, timeouts and the constructs NonBacktracking rejects, when IgnoreCase reads the culture, and ISBN validation and Turkish slugs for Bookstore, with real output.
The Cost of Regex: ReDoS, Catastrophic Backtracking, Readability and Testing Regex
A pattern with nested quantifiers, overlapping alternation or adjacent .* makes an exponential or polynomial number of attempts on an input that almost matches; in our measurement ^(a+)+$ took 10 seconds at 28 letters in .NET and 0.07 ms with NonBacktracking. We recognize dangerous constructs with PCRE2 step counts and cover Cloudflare's 2019 outage, the Angular validator and server validation, readable patterns with (?x), a test table with xUnit [Theory] and the MailAddress decision for email.